Win.Downloader.DelphiDownloader-6609388-1 — RTF malware analysis

Static analysis result for SHA-256 119ae4ad1797b6e1…

MALICIOUS

RTF

3.08 MB Authoring application: LibreOffice/5.3.7.2$Linux_X86_64 LibreOffice_project/6b8ed514a9f8b44d37a1b96673cbbdd077e24059 First seen: 2019-01-11
MD5: 89beb207e7095d237c4d25c4c6e17e97 SHA-1: 15010f7cea913f2a36c56da7d73c2b9eb5a3878f SHA-256: 119ae4ad1797b6e1a46404264de95c1e5e0bb95920926ed9740676864ebb6411
522 Risk Score

Malware Insights

Win.Downloader.DelphiDownloader-6609388-1 · confidence 95%

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.007 JavaScript

The RTF document contains multiple indicators of malicious OLE objects, including composite monikers and excessive hex data, strongly suggesting exploitation of CVE-2017-8570. ClamAV detections confirm this, identifying the sample as a Delphi Downloader. The embedded OLE object likely contains shellcode or a script designed to download and execute a second-stage payload.

Heuristics 12

  • Composite Moniker — CVE-2017-8570 (drops SCT script) critical CVE related CVE_2017_8570
    RTF \objdata decodes to OLE data containing the Composite Moniker — CVE-2017-8570 (drops SCT script) CLSID — the vulnerable control/moniker is embedded directly in the document's object stream, the delivery shape of this exploit. RTF objects auto-render when Word opens the file.
  • Composite Moniker in RTF OLE object high CVE related RTF_COMPOSITE_MONIKER_RELATED
    RTF contains Composite Moniker CLSID in OLE object context, but no nearby scriptlet/SCT payload was confirmed. Treat as related moniker attack-surface evidence rather than proof of CVE-2017-8570 exploitation.
  • ClamAV: Win.Downloader.DelphiDownloader-6609388-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Downloader.DelphiDownloader-6609388-1
  • PE header (with DOS stub) in hex data critical RTF_MZ_HEX
    Hex-encoded PE (MZ + DOS stub) found inside RTF — likely an embedded executable payload
  • Automatically linked OLE object high RTF_OBJAUTLINK
    RTF contains \objautlink — an automatically linked OLE object surface that can be updated or activated when Word opens the document.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • Package object class high RTF_OBJCLASS_PACKAGE
    OLE Package object — can wrap arbitrary files
  • Large hex data blocks in OLE object high RTF_EXCESSIVE_HEX
    RTF contains ~1637KB of hex-encoded data inside \objdata sections — may hide a payload
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • OLE object data medium RTF_OBJDATA
    RTF contains 3 \objdata section(s) — embedded OLE objects
  • Embedded OLE object medium RTF_OBJEMB
    RTF contains \objemb — embedded OLE object
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://charactercounts.org/home/index.html In RTF body
    • http://ethix.org/2008/10/01/the-truth-as-I-know-itIn RTF body
    • http://aura.antioch.edu/etds/158In RTF body
    • http://www.jcs.mil/speechIn RTF body
    • http://cgsc.contentdm.}{In RTF body
    • http://conversationswithbillkristol.org/}{In RTF body
    • http://babel.hathitrust.org/cgi/imgsrv/download/In RTF body
    • https://www.law.cornell.edu/uscode/text/5/3331In RTF body
    • https://supreme.justia.com/cases/federal/us/417/733/case.htmlIn RTF body
    • http://strategicstudiesinstitute.army.mil/pubs/parameters/In RTF body
    • http://osd.dtic.mil/news/In RTF body
    • http://plato.stanford.edu/archives/In RTF body
    • http://doni.documentservices.dla.mil/US%20In RTF body
    • http://www.nytimes.com/2014/11/30/magazine/the-militarys-rough-justice-on-sexual-assault.html?_r=0In RTF body
    • http://cgsc.contentdm.oclc.org/cdm/singleitem/collection/In RTF body
    • http://carlisle-www.army.mil/usawc/In RTF body

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00237ab9.bin rtf-objdata-decoded RTF \objdata at offset 0x237AB9 447198 bytes
SHA-256: eb81d3aff9866fe0be861bf7f6fe313a62063783abb3e56e3910183e18a35130
Detection
ClamAV: Win.Downloader.DelphiDownloader-6609388-1
Obfuscation or payload: unlikely
objdata_01_off003120b4.bin rtf-objdata-decoded RTF \objdata at offset 0x3120B4 708 bytes
SHA-256: 5920b14b7b3935f4eedb63e99c4e72039fd3ac55ed4a2f1c58f1be5ad630d1ce
Detection
ClamAV: Xml.Malware.Squiblydoo-6728833-0
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): WScript.Shell").Run("cmd /c %tmp%\\vsrss.exe",0,false);
objdata_02_off0031268b.bin rtf-objdata-decoded RTF \objdata at offset 0x31268B 2633 bytes
SHA-256: 7c7ddc75982234e1a7f3f0cdc7949c6e7d0660075e27296f9cddbbb562df478d

Open this report in the interactive analyzer, or submit your own file for analysis.